Meta Muse: Shared AI chats can be found through DNS databases

What this is about

Muse is a new general-purpose AI agent from Meta. Researchers at the security firm Claroc reported on Monday that Muse can expose sensitive information when users share conversations via web links. When Ars Technica asked (the report appeared there first and then at Wired), Meta said the sharing feature has been paused while the company reviews the report and considers changes.

How the links became discoverable

Like many services, Muse lets you share searches, conversations, images and similar content. This generates a unique URL that anyone can use to open the page. Normally, such addresses contain a long, hard-to-guess string so unauthorized people can't find them. In principle, Muse does that too.

The problem lies in how the address is built: all links use the domain cf.metaaiusercontent.com, and the conversation title sits in the subdomain, together with a long string, before the actual domain. Simplified examples from the report are home-sale-budget-9f21c8a3.cf.metaaiusercontent.com or loan-application-draft-a4c9e2.cf.metaaiusercontent.com. Had the title been in the path after the domain, it would not have ended up in public DNS data.

Passive DNS as an entry point

DNS maps domain names to IP addresses. Passive DNS services store these mappings over time, along with name server and mail server records. They collect the responses through sensors on recursive DNS resolvers or other infrastructure. As soon as someone clicks a share link, the resolution of the subdomain is recorded and can be retrieved from a searchable database. Quite a few commercial services offer this.

This is how Claroc was able to enumerate 6,800 links. The researchers call the phenomenon "GhostShares": pages that open for people who were never given the link and who can find it on their own. They stress that many AI assistants share via public link; Muse is only easy to search because the title is embedded in the web address.

What the researchers found

After opening a few hundred links, they came across content that was clearly not meant to be public, including:

• a candidate's notes preparing for a confidential interview with a leading AI lab, with the name of the internal contact and the date
• an internal revenue analysis from a national marketing company, addressed to the CEO
• a small-business owner's loan application, including the amount
• a to-do list with a bank fraud alert, partial account number, amount and time
• an internal performance report from a real estate investor with two addresses and exact figures for returns, income and mortgages
• an annual vacation calendar for a workforce, with dozens of names

The researchers wrote: "If you had asked us beforehand, we would have guessed that collecting these took real effort. It took one query."

Meta's response

Meta said it has opened the bug bounty program for Muse so researchers can report different scenarios. Users can share certain Muse artifacts, which creates a page that anyone with the link can open. The company said it has paused the feature and is reviewing changes to how these links can be discovered. Claroc co-founder and CTO Asaf Aprozper said he reported the finding on October 8 through the bug bounty program and also tried to reach Meta employees via LinkedIn; he said he got no response.

Background: Muse and the promise of trust

Muse quickly climbed to the top of Apple's App Store charts. The assistant fills out forms, books appointments, shops and creates documents on its own. To do that, it needs access to much of a user's accounts. Meta CEO Mark Zuckerberg had described Muse last month as "built from the ground up for privacy and security."

Just three weeks after launch, macOS security expert Patrick Wardle found a zero-day vulnerability (a flaw unknown to the vendor at the time of discovery). It allowed any other app on the same device to take full control of the Muse account. Meta played down the severity because exploiting it requires an already compromised device. But Wardle had shown that a simple ClickFix attack (users are tricked into running malicious commands themselves) is enough to take over an account; according to the report, Meta did not address that.

Our take

The case shows that small design decisions about links can have big privacy consequences, especially for an agent with privileged access to accounts. For users, this means the specific risk is gone for now, since the feature is paused. But links that were already generated may still be in circulation or in DNS archives; the source doesn't say. It remains unclear whether and how Meta will rebuild the links, and whether the data has already been exploited. Together with the Wardle flaw, the incident raises the question of whether Muse deserves the trust it asks for. Also notable is the lack of any reaction to the bug bounty report: Meta only commented after a press inquiry.